CVE-2026-101259: Apache Camel CoAP component information disclosure in error responses

CVE-2026-101259 · Severity: medium · CVSS 5.3 · Published 2026-10-26

Apache Camel is an integration framework used to build data pipelines and message-driven applications. When a CoAP (Constrained Application Protocol) endpoint in Camel encounters an error converting the response message, it exposes sensitive internal details—such as class names, package paths, file paths, and backend hostnames—in the error response sent to remote clients. An attacker can exploit this by crafting requests that cause type conversion failures, gaining insight into the application's internal structure and infrastructure.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-101259 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101259 being exploited in the wild.
How severe is CVE-2026-101259?
Medium severity, with a CVSS score of 5.3, published 26 October 2026.
Which products and versions are affected?
Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.1.
Is there a fix for CVE-2026-101259?
Yes: fixed in Apache Camel 4.23.0; 4.22.2 (4.22.x branch); 4.18.5 (4.18.x branch). Until then: Ensure the CoAP route response can always be built successfully: convert the message body to byte[] or String as the final route step, assign only properly-typed values to CamelCoapMaxAge and CamelCoapETag headers, and add an onException handler to catch conversion failures before the consumer is reached. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101259 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-101259?
Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Apache Camel 4.23.0; 4.22.2 (4.22.x branch); 4.18.5 (4.18.x branch)

Ensure the CoAP route response can always be built successfully: convert the message body to byte[] or String as the final route step, assign only properly-typed values to CamelCoapMaxAge and CamelCoapETag headers, and add an onException handler to catch conversion failures before the consumer is reached.

Technical details

The vulnerability exists in the CamelCoapResource class, which catches exceptions during response building and sends the exception message as the CoAP 5.00 error payload without filtering. The issue occurs when type conversion fails (e.g., converting the message body to byte[] or headers to their expected types) after the route completes, outside the route's error handler. The exception message reveals class names, package names, string representations of values (such as file paths), and underlying cause details; a remote CoAP client can read this information directly from the error response.

Affected products

  • Apache Camel 4.0.0 to 4.18.4, 4.19.0 to 4.22.1

Timeline

  • 2026-10-26: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.